Fix: [for cherry-picking] Updated body-policy.sh so ABOUT_THE_CONTROL f - #88
Conversation
|
PR author is in the excluded authors list. |
ApprovabilityVerdict: Needs human review Unable to check for correctness in 9962817. This PR modifies security policy enforcement logic in public-repo-guard/body-policy.sh, changing how the ABOUT_THE_CONTROL allowlist interacts with different rule types. Changes to security-related files require review by the designated code owners (wave-av/core-team). You can customize Macroscope's approvability policy. Learn more. |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| matches="$(printf '%s' "$raw" \ | ||
| | rg -vN -- 'guard:allow[[:space:]]+[^[:space:]]' \ | ||
| | rg -vNiP -- "$ABOUT_THE_CONTROL" || true)" | ||
| | { if [[ "$allow_control_prose" == true ]]; then rg -vNiP -- "$ABOUT_THE_CONTROL"; else cat; fi; } \ | ||
| || true)" |
There was a problem hiding this comment.
🔍 Existing fixture no longer covers the control-allowlist path it was written for
The fixture expect 0 'talking about the control' (scripts/public-repo-guard/tests/body-policy.test.sh:72-73) was written to prove that a line naming the gate is exempt. Its body ("body-policy blocks a private repo named next to a SECRET_TOKEN") contains no name from GUARD_PRIVATE_REPOS, so the private-repo-ops rule never matched it in the first place — it passes both before and after this change and now proves nothing about the narrowed allowlist. I ran the whole fixture suite (with a grep -P shim, since the local ripgrep is built without PCRE2) and all 21 cases pass, so the change is not test-breaking, but the new behavior is untested: there is no positive fixture asserting that e.g. an AWS key or Tailscale IP on a line that also says "public-repo-guard" now BLOCKS, and no negative fixture pinning that the prose rule still exempts it.
Was this helpful? React with 👍 or 👎 to provide feedback.
Fixed Findings
Automated fix from agentic review of #87